Momental is a small, partner-led advisory for banks, insurers, asset managers and regulated technology firms. We do four things: assessments & compliance, identity & privileged access, threat detection & response, and growth-stage strategy. Each engagement is conducted as a closed file.
A coherent practice, not a menu. Each engagement borrows the parts it needs and leaves the rest, but the disciplines are taught — and conducted — together.
Structured reading of your security posture against standards your supervisors actually use. The output: a defensible target picture, sequenced plan, named owners.
IAM and PAM are the spine of the modern security architecture. We design and steward the introduction — strategy to retirement of legacy components.
Detect incidents before they escalate; respond with composure. We design monitoring, incident and change processes and govern managed-service vendors by KPI.
Advice during growth phases, market entry and valuation moments. Drawn from years inside DAX-40 banks and tier-one consultancies.
Where the discrete project does not suffice, two recurring engagements anchor strategic security at C-level — planned, confidential, partner-led.
For growth companies, Mittelstand and PE portfolio holdings without a CISO of their own — yet under regulatory or contractual pressure.
For CISOs, Heads of Cyber and IT leaders in regulated industries who want sparring at eye-level — without the apparatus of a consulting project.
Security that endures in regulated industries requires more than a framework. It requires clarity on risks, discipline in execution, and a model that scales with the institution.
Working knowledge of DORA, NIS2 and ISO/IEC 27001 — as a shared language between business, IT and supervisor.
Proprietary AI workflows accelerate assessments, policy review, regulatory mapping and reporting — delivering tier-one depth at boutique scale.
Where sensible, we lean on established managed services — with clear KPIs and stewardship that surfaces risks rather than masking them.
Strategy, architecture, implementation and operational handover from one office — without seams between advisory and realisation.
Every measure is documented so it withstands internal and external review — BaFin, EZB, MAS.
Each engagement is conducted by one partner, by appointment. No rotating juniors. No handoffs at deliverable boundaries.
Engagements are described without the client's name. References are exchanged in private, after a short introductory conversation.
| Engagement | Scope | Sector | Yr. |
|---|---|---|---|
| DORA readiness across a European insurer's ICT estate | ISMS · ICT-risk · third-party | Insurance · Group | 2026 |
| PAM replatforming for a DAX-40 bank — CyberArk to scale | PAM · IAM · decom | Banking · Tier-One | 2025 |
| Threat-detection KPI model for a regulated cloud provider | SOC · KPI · vendor mgmt | Cloud · MAS-supervised | 2025 |
| Fractional CISO mandate, PE-held asset manager | CISO · board reporting | Asset Mgmt · PE-held | 2024– |
| ISMS to ISO 27001 inside a fintech preparing IPO | ISMS · 27001 · IPO-ready | Fintech · Pre-IPO | 2024 |
| Decommissioning end-of-life IAM at a custody bank | IAM · legacy retirement | Custody · Tier-Two | 2023 |
Momental is conducted by partners, principals and senior advisors who have spent careers inside the institutions they now advise. The strength of the firm is the strength of the team — not the résumé of any one of us.
Every engagement is led and delivered by senior practitioners — no rotating juniors, no anonymous output chains. Where specialist research or analysis supports the work, it is sourced deliberately, curated by the lead advisor, and fully accountable. The disciplines were learned at DAX-40 banks, tier-one consultancies and regulated technology firms; the judgment stays in Frankfurt am Main, by appointment.
Five principles we keep posted by the door. They are not slogans; they are arguments we have had with ourselves and won.
Momental was founded in 2024 as a small, partner-led advisory for institutions whose security must answer to regulators and boards. We work in single threads, by appointment. The output is rarely a deck — it is usually a decision, written in a way that survives the next audit.
A small office is freer than a large one. We are deliberately under-marketed.
Relationships measured in years, not engagements measured in weeks.
If a finding cannot be written in a sentence a non-technical board member can repeat, it is not finished.
Every measure documented to audit standard — to be ready for the supervisor, not to flatter them.
We turn down work that would dilute the practice. The engagements we have declined are, quietly, the proof.
Whether you carry a defined mandate or only a question worth asking, the simplest start is a short note.
Tell us, in a paragraph, the situation as you understand it. We will write back with three questions and a time.
→ [E-Mail]